shit, forgot one params.permit! in the category controller